SORBS Contact

Mon Aug 14 04:11:58 UTC 2006


> Obligation to _whom_?   My only obligations are to those who _pay_ me for
> access to my systems/resources.  If the people who *do* pay me for use of
> my systems/resources "don't want" that cr*p, then I do 'have an
> obligation'
> to _not_ deliver that traffic.

	Nonsense. You have tort obligations as well as contractual obligations.
Specifically, if you take custody of someone else's data, and you have no
contract with that person, you have a tort obligation not to destroy it.

	Your argument is similar to a mall that claims they can shoot people who
don't buy anything. After all, their only obligation is to those who pay
them. But of course neither you nor they can do that. By setting up a
network and connecting it to the Internet, you know that you will sometimes
carry packets that are neither from nor to someone with whom you have a
contract. Those are not your packets, and you have no contract with their
owners, but you handle them in the ordinary course of your business, so you
have a variety of tort obligations to them.

	The same would be the case if I used FedEx to return something of yours to
you. If they destroyed your property, you would have a claim against them
even though you didn't pay them for anything.

	I see the view you are expressing quite commonly among network operators
and it is, IMO, dangerous. It is, of course, your network. But it handles
other people's data.

	Of course, you can protect your own network. Just as FedEx can destroy a
bomb if someone tries to ship it through them. But you cannot do whatever
you want with "your packets" unless they really are your packets.

	I will defend your right to do anything reasonable. However, it is
incorrect and dangerous to assert that because it's "your network" you can
do anything you want. Even if it's your mall, you can't invite people into
it and then shoot them just because you have no contract with them.

	DS